HIPAA Hosting Q&A with a Certified HIPAA Practitioner & Security Specialist

We get a lot of questions from clients about HIPAA compliance and security. To help clear up any confusion, our Certified HIPAA Practitioner (CHP) and Certified HIPAA Security Specialist (CHSS) Joe Dylewski of ATMP Solutions answered the questions we shared with him below:

Q: What is the association of NIST w/ an independent HIPAA audit?
A: NIST is the National Institute of Standard and Technology. ATMP, utilizing SecureGRC, leverages NIST guidance when conducting HIPAA Risk Assessments.

We get a lot of questions from clients about HIPAA compliance and security. To help clear up any confusion, our Certified HIPAA Practitioner (CHP) and Certified HIPAA Security Specialist (CHSS) Joe Dylewski of ATMP Solutions answered the questions we shared with him below:

Q: What is the association of NIST w/ an independent HIPAA audit?
A: NIST is the National Institute of Standard and Technology. ATMP, utilizing SecureGRC, leverages NIST guidance when conducting HIPAA Risk Assessments.

Q: Is it possible to be HIPAA compliant without an HROC (HIPAA Report on Compliance – or without a HIPAA risk assessment?
A: No. 45 CFR 164.308(a)(1)(ii)(a) is a required Implementation Specification under the HIPAA Security Rule, Security Management Process Standard. An HROC is not a required document. However, organizations must be able to produce evidence that they have completed an assessment and resolved any deficiencies or vulnerabilities. An HROC demonstrates the auditable steps that an organization took in that process.

Q: Can you explain where the HITECH act specifies antivirus is “required”?
A: “Protection from Malicious Software,” 45 CFR 164.308(a)(5)(ii)(b), is an Addressable Implementation specification under the HIPAA Security Rule, Security Awareness and Training Standard. Addressable does not equate to Optional.

“Protection from Malicious Software” is one of the key HIPAA Implementation Specifications as it speaks to the Confidentiality, Integrity, and Availability of Electronic Protected Health Information.

Q: What about offsite backup and/or disaster recovery?
A: The ability to store a recoverable set of Electronic Protected Health Information (ePHI), and test that process, are critical components that are governed by multiple HIPAA Implementation Specifications and Standards:

Contingency Plan Standard, 45 CFR 164.308(a)(7)(i)

• Data Backup Plan (Required) – 45 CFR 164.308(a)(7)(ii)(A)
• Disaster Recovery Plan (Required) – 45 CFR 164.308(a)(7)(ii)(B)
• Emergency Mode Operation Plan (Required) – 45 CFR 164.308(a)(7)(ii)(C)
• Testing and Revision Procedures (Addressable) – 45 CFR 164.308(a)(7)(ii)(D)

Device and Media Controls Standard, 45 CFR 164.310(d)(1)

• Data Backup and Storage (Addressable) – 45 CFR 164.310(d)(2)(iv)

In addition to the Standards and Implementation Specifications listed, there are many others that factor into the procedures and safeguards that are implemented in the Backup and Recovery Process.

Q: What about a firewall?
A: A firewall can be considered in multiple Standards and Implementation Specifications across the HIPAA Administrative, Physical, and Technical Safeguards. Remember that the purpose of a firewall is to restrict access to networks through a selective process of blocking inbound traffic.  In some cases, firewalls or content filters will also block outbound traffic.

While HIPAA does not call for the direct implementation of firewall technology, in most cases, it is the most reasonable and practical approach to addressing the requirements laid out in the HIPAA regulations.

Q: What methodology did you use to come up with the 136 audited components for ATMP’s independent HIPAA audit?
A: In the development of the assessment methodology, a combination of technical, health care, and HIPAA knowledge was used. HIPAA is very clear in some areas and provides guidance in other areas. An objective risk based approach was integrated in the overall assessment process making it adaptable to any Covered Entity or Business Approach.

Q: Can you explain why there is no such thing as “HIPAA certified”?
A: Unlike other compliance standards such as ISO and SOX, HIPAA has not yet implemented a single audit standard. The industry relies on individuals and organizations who possess background in Information Technology, Health Care, and HIPAA to reasonably guide Covered Entities and Business Associates through the compliance process.

One of the main reasons that HIPAA has not implemented a single audit standard is due to the fact that one set of regulations governs all health care entities and their business partners. In other words, unlike PCI, HIPAA does not have a subset of requirements in place, based on the size of the organization. HIPAA, in its original and current state, was designed to be a flexible, scalable, and vendor neutral architecture for compliance.

Q: How many audited components go with each standard/citation ?
A: Based on the size and type of organization, we have adopted the following framework:

Defined Scope of HIPAA Compliance

Still have other HIPAA-related questions? For more HIPAA hosting resources, see our HIPAA FAQ and HIPAA Glossary of Terms.

Joe Dylewski, President, ATMP Group

Joseph Dylewski is a twenty-five year Information Technology Professional veteran, a Certified HIPAA Professional (CHP), and a Certified HIPAA Security Specialist (CHSS) with ten years spent exclusively in the Healthcare Industry. In addition to holding positions as a Project Manager and Director of Information Technology, Joseph has also served as a Healthcare IT Services Practices Director and Account Manager with a proven track-record of successfully delivering end-to-end IT application and infrastructure project services. Joseph also currently serves as an Assistant Professor at Madonna University.